Human rights watchdog calls for privacy law shake-up

The government should streamline current legislation on information privacy “so that it is easier for organisations to understand their responsibilities and simpler for citizens to know and use their rights”, the Equality and Human Rights Commission has said.

The Commission claimed that “piecemeal reform” such as the proposals in the Protection of Freedoms Bill was unlikely to be enough to ensure people’s rights were protected.

The call for an overhaul was made following publication of an EHRC-commissioned report into privacy, which described the way government and its agencies collect, use and store personal data as deeply flawed. The authors said that public bodies may be unaware they are breaking the law “as the complexity of the legal framework means their obligations are unclear”.

The EHRC also recommended that:

• The government should ensure that public bodies and others “have to properly justify why they need someone’s personal data and for what purpose”. The Commission said that there should be a vetting process for any requirement to use personal data for any purpose other than for which it was collected. Organisations should also ensure compliance with the current data protection and RIPA regimes, in addition to the Human Rights Act.
• all public bodies should “carefully consider the impact on information privacy of any new policy or practice and ensure that all requests for personal data are justified and proportionate”.

The report, Protecting Information Privacy, by academics at the University of Edinburgh and the University of British Columbia, claimed that current laws were failing to stop breaches of personal data privacy and were not keeping pace with the rapid growth in personal data collection.

The report also concluded that it was difficult for people to find out what information is held on them, by which bodies, and how it is being used. “For example, as there is currently no law regulating the use of CCTV cameras it would be very difficult for someone to find which organisations hold footage of them,” the ECRC said.

The authors suggested that it was hard as well for people to check the accuracy of personal data, to hold organisations to account for errors or misuse, or to challenge decisions made on the basis of that information.

The report predicted that breaches of privacy were likely to get worse in the future “as demand for personal information increases and as new technology is developed for collecting, storing and sharing that data that are not covered by existing legislation or regulations”.

Geraldine Van Bueren, a Commissioner for the Equality and Human Rights Commission said: “It’s important that the government and its agencies have the information they need about us to do their job, for example to fight crime, or protect our health. However, the state is holding increasing amounts of information about our lives without us knowing, being able to check that it’s accurate or being able to challenge this effectively.

“This needs to change so that any need for personal information has to be clearly justified by the organisation that wants it. The law and regulatory framework needs to be simplified and in the meantime public authorities need to check what data they have and that it complies with the existing laws.”

Philip Hoult